ProPublica: In Breaking USAID, the Trump Administration May Have Broken the Law 

“It is a catastrophic privacy and information security violation for a band of some government and some nongovernment personnel to barge into an agency and take over systems that contain personal information,” said John Davisson, director of litigation at Electronic Privacy Information Center and one of the country’s foremost authorities on the Privacy Act. Breaking the law can carry civil penalties and a minimum $1,000 fine for each violation if the victim can prove they were harmed, or much more if there were damages like loss of income. 

[…] 

Davisson and others said that the law, which Congress passed with overwhelming support from both parties in the wake of Watergate, is meant to prevent presidents and others in high office from abusing their access to records for political ends. “The Privacy Act stands at the fountainhead of all this,” he added. “It stops that constitutional crisis from tipping off in the first place.” 

Read more here.